[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7ESWJ3JBKZ4WEHW69R8290B":3,"skill-same:01M7ESWJ3JBKZ4WEHW69R8290B":47},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":25,"commitSha":26,"skillDirectory":27,"forksCount":28,"repositoryHtmlUrl":29,"repositoryHomepageUrl":6,"ownerHtmlUrl":30,"ownerBlogUrl":31,"ownerDescription":6,"updatedAt":32,"install":33,"resources":46},"01M7ESWJ3JBKZ4WEHW69R8290B","linux-pro",null,"Linux systems guidance — filesystem, permissions, processes, networking, logs, and production server administration.","TanNhatCMS\u002Fjarvis","TanNhatCMS","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F113796420?v=4","01M753MV17KG5CD3152G3WQEQY","KietNT","01M7EKEDYVYQ6PWVJJMZ911VMX",0,"MIT","https:\u002F\u002Fgithub.com\u002FTanNhatCMS\u002Fjarvis\u002Fblob\u002Fmain\u002Fskills\u002Fams-linux-pro\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: linux-pro\ndescription: Linux systems guidance — filesystem, permissions, processes, networking, logs, and production server administration.\ncategory: development\n---\n\n## Overview\n\nLinux is the substrate everything runs on: containers, VMs, CI runners, and most servers. Fluency with the filesystem, permissions, processes, networking, and logs is what separates engineers who guess from engineers who diagnose. You don't need to be a sysadmin — you need the working knowledge that makes every other skill more effective.\n\nThis skill covers the Linux fundamentals that come up constantly: navigating and managing systems, understanding permissions, controlling processes, debugging networking, reading logs, and the production practices (users, SSH, updates, backups) that keep servers healthy.\n\n## When to use\n\n- Diagnosing server issues (disk full, OOM, high load, network).\n- Managing files, permissions, and ownership.\n- Controlling processes and services.\n- Debugging networking (DNS, ports, firewalls, routing).\n- Reading and managing logs (journald, logrotate).\n- Setting up a production Linux server (users, SSH, updates).\n- Writing scripts that interact with the system.\n\n## Core concepts\n\n- **Filesystem hierarchy.** `\u002Fetc` (config), `\u002Fvar\u002Flog` (logs), `\u002Fvar\u002Flib` (state), `\u002Fopt` and `\u002Fusr\u002Flocal` (add-on software), `\u002Ftmp` (ephemeral), `\u002Fproc` and `\u002Fsys` (kernel interfaces). Know where things live and `\u002Fproc` becomes a diagnostic goldmine.\n- **Permissions.** `rwx` for user\u002Fgroup\u002Fother, octal notation (755, 644, 600), ownership (`chown`), and special bits (setuid, setgid, sticky). Principle: least privilege — 777 is never the answer; find the right user\u002Fgroup instead.\n- **Users and sudo.** Service accounts per application, humans in `sudo` with logged commands, no shared root passwords, SSH keys only. `sudo` config via `\u002Fetc\u002Fsudoers.d\u002F` snippets, never editing the main file blindly.\n- **Processes.** Everything is a process: `ps`, `top`\u002F`htop`, signals (`TERM` vs `KILL` — always TERM first, KILL only when necessary), nice levels, and cgroups (what containers use for limits). Zombie processes indicate a parent not reaping children.\n- **systemd.** The init system: units (services, timers, sockets), `systemctl` for control, `journalctl` for logs, timers replacing cron for most scheduled tasks. Write proper unit files with restart policies and sandboxing options.\n- **Package management.** apt\u002Fdnf\u002Fpacman — keep systems updated (unattended-upgrades for security patches), pin versions where stability matters, and know what's installed (`dpkg -l`, `rpm -qa`).\n- **Networking.** Interfaces (`ip addr`), routing (`ip route`), DNS (`\u002Fetc\u002Fresolv.conf`, `systemd-resolved`), sockets (`ss -tlnp` — what's listening, on what, owned by whom), firewalls (nftables\u002Fufw\u002Ffirewalld). Diagnose layer by layer: link → IP → route → DNS → port → firewall → app.\n- **Disk.** `df` (filesystem usage), `du` (directory usage), inodes (`df -i` — \"disk full\" with free space means inode exhaustion), mounts (`\u002Fetc\u002Ffstab`), LVM for flexible volumes. Full disks cause bizarre failures — monitor them.\n- **Memory.** `free`, `\u002Fproc\u002Fmeminfo`, OOM killer (check `dmesg` for kills), swap (emergency headroom, not a strategy). Containers' memory limits trigger OOM kills that look like app crashes.\n- **Logs.** journald (`journalctl -u service -f`, `--since`), `\u002Fvar\u002Flog` files, logrotate preventing disk-fill. Structured logging from apps makes `journalctl` queries powerful; correlate with request IDs.\n- **SSH.** Key-based auth only, `sshd_config` hardened (no root login, no password auth), `~\u002F.ssh\u002Fauthorized_keys` managed, jump hosts\u002Fbastions for private networks, agent forwarding avoided (use ProxyJump instead).\n- **Time.** NTP\u002Fchrony keeping clocks in sync — clock skew breaks TLS, Kerberos, and distributed systems. Verify with `timedatectl`.\n- **Cron vs systemd timers.** Timers give you logging, dependencies, and failure handling that cron lacks; use timers for anything important, cron for trivial personal tasks.\n- **Backups.** `rsync`\u002F`restic`\u002F`borg` for files, database-native dumps for DBs, tested restores. Automate, monitor, and periodically verify — untested backups are rumors.\n- **Security basics.** Minimal installed packages, automatic security updates, fail2ban or equivalent for SSH, no unnecessary listening services (`ss -tlnp` audit), file integrity awareness.\n\n## Practical workflow\n\n1. **Diagnose systematically.** Load (`uptime`, `htop`), disk (`df -h`, `df -i`), memory (`free -h`, `dmesg | grep -i oom`), network (`ss`, `ping`, `curl -v`), logs (`journalctl`). Work from symptoms to layer, not guesses.\n   ```bash\n   # the 60-second triage\n   uptime; df -h; df -i; free -h\n   ss -tlnp | head -20\n   journalctl -p err --since \"15 min ago\" | tail -20\n   ```\n2. **Manage permissions correctly.** Least-privilege ownership; groups for shared access; `find` for permission audits:\n   ```bash\n   chown -R app:app \u002Fsrv\u002Fapp\n   chmod 750 \u002Fsrv\u002Fapp\n   find \u002Fsrv\u002Fapp -type f -perm \u002Fo+w  # world-writable files: investigate\n   ```\n3. **Control services with systemd.** Write unit files with `Restart=on-failure`, sandboxing (`ProtectSystem`, `PrivateTmp`), resource limits; timers for scheduled work.\n   ```ini\n   [Unit]\n   Description=Shop API\n   After=network.target\n   [Service]\n   User=app\n   ExecStart=\u002Fopt\u002Fshop\u002Fapi\n   Restart=on-failure\n   ProtectSystem=strict\n   [Install]\n   WantedBy=multi-user.target\n   ```\n4. **Harden SSH.** Key-only auth, no root login, non-standard port optional (obscurity, not security), fail2ban, ProxyJump instead of agent forwarding.\n5. **Debug networking layer by layer.** `ip addr` → `ip route` → `getent hosts`\u002F`dig` → `ss -tlnp` → firewall rules → `curl -v`. Each layer has its own tools; skipping layers wastes hours.\n6. **Manage logs.** journald with persistent storage and rate limits; logrotate for file logs; ship to central logging; alert on error patterns, not just disk space.\n7. **Keep systems updated.** Automatic security updates; planned maintenance windows for major upgrades; know what's installed and why.\n8. **Back up and verify.** Automated backups with monitoring; periodic restore tests; document the recovery procedure — the runbook written during calm saves the outage.\n\n## Common pitfalls\n\n- **`chmod 777`** — never the fix; find the right user\u002Fgroup and permission.\n- **KILL as first resort** — data corruption and unclean shutdown; TERM first, wait, then KILL.\n- **Ignoring inodes** — \"disk full\" with free space; `df -i` reveals inode exhaustion (millions of small files).\n- **Full disks from logs** — no logrotate\u002Fjournald limits; monitor disk and bound log growth.\n- **Password SSH auth** — brute-force target; keys only, fail2ban as backup.\n- **Running everything as root** — compromise blast radius; service users per app.\n- **No NTP** — clock skew breaking TLS and auth; chrony everywhere.\n- **Cron for critical tasks** — no logging or failure handling; systemd timers instead.\n- **Untested backups** — discovered broken during an outage; verify restores regularly.\n- **Firewall misconfigurations** — locking yourself out remotely; test rules with a safety revert (e.g., `at` job restoring access).\n- **OOM kills misdiagnosed** — app \"crashing\" that's actually memory limits; check `dmesg`.\n- **Stale packages** — unpatched CVEs; automatic security updates at minimum.\n- **Deleting open files** — `rm` on a file a process holds doesn't free space; truncate or restart the holder.\n","## Overview\n\nLinux is the substrate everything runs on: containers, VMs, CI runners, and most servers. Fluency with the filesystem, permissions, processes, networking, and logs is what separates engineers who guess from engineers who diagnose. You don't need to be a sysadmin — you need the working knowledge that makes every other skill more effective.\n\nThis skill covers the Linux fundamentals that come up constantly: navigating and managing systems, understanding permissions, controlling processes, debugging networking, reading logs, and the production practices (users, SSH, updates, backups) that keep servers healthy.\n\n## When to use\n\n- Diagnosing server issues (disk full, OOM, high load, network).\n- Managing files, permissions, and ownership.\n- Controlling processes and services.\n- Debugging networking (DNS, ports, firewalls, routing).\n- Reading and managing logs (journald, logrotate).\n- Setting up a production Linux server (users, SSH, updates).\n- Writing scripts that interact with the system.\n\n## Core concepts\n\n- **Filesystem hierarchy.** `\u002Fetc` (config), `\u002Fvar\u002Flog` (logs), `\u002Fvar\u002Flib` (state), `\u002Fopt` and `\u002Fusr\u002Flocal` (add-on software), `\u002Ftmp` (ephemeral), `\u002Fproc` and `\u002Fsys` (kernel interfaces). Know where things live and `\u002Fproc` becomes a diagnostic goldmine.\n- **Permissions.** `rwx` for user\u002Fgroup\u002Fother, octal notation (755, 644, 600), ownership (`chown`), and special bits (setuid, setgid, sticky). Principle: least privilege — 777 is never the answer; find the right user\u002Fgroup instead.\n- **Users and sudo.** Service accounts per application, humans in `sudo` with logged commands, no shared root passwords, SSH keys only. `sudo` config via `\u002Fetc\u002Fsudoers.d\u002F` snippets, never editing the main file blindly.\n- **Processes.** Everything is a process: `ps`, `top`\u002F`htop`, signals (`TERM` vs `KILL` — always TERM first, KILL only when necessary), nice levels, and cgroups (what containers use for limits). Zombie processes indicate a parent not reaping children.\n- **systemd.** The init system: units (services, timers, sockets), `systemctl` for control, `journalctl` for logs, timers replacing cron for most scheduled tasks. Write proper unit files with restart policies and sandboxing options.\n- **Package management.** apt\u002Fdnf\u002Fpacman — keep systems updated (unattended-upgrades for security patches), pin versions where stability matters, and know what's installed (`dpkg -l`, `rpm -qa`).\n- **Networking.** Interfaces (`ip addr`), routing (`ip route`), DNS (`\u002Fetc\u002Fresolv.conf`, `systemd-resolved`), sockets (`ss -tlnp` — what's listening, on what, owned by whom), firewalls (nftables\u002Fufw\u002Ffirewalld). Diagnose layer by layer: link → IP → route → DNS → port → firewall → app.\n- **Disk.** `df` (filesystem usage), `du` (directory usage), inodes (`df -i` — \"disk full\" with free space means inode exhaustion), mounts (`\u002Fetc\u002Ffstab`), LVM for flexible volumes. Full disks cause bizarre failures — monitor them.\n- **Memory.** `free`, `\u002Fproc\u002Fmeminfo`, OOM killer (check `dmesg` for kills), swap (emergency headroom, not a strategy). Containers' memory limits trigger OOM kills that look like app crashes.\n- **Logs.** journald (`journalctl -u service -f`, `--since`), `\u002Fvar\u002Flog` files, logrotate preventing disk-fill. Structured logging from apps makes `journalctl` queries powerful; correlate with request IDs.\n- **SSH.** Key-based auth only, `sshd_config` hardened (no root login, no password auth), `~\u002F.ssh\u002Fauthorized_keys` managed, jump hosts\u002Fbastions for private networks, agent forwarding avoided (use ProxyJump instead).\n- **Time.** NTP\u002Fchrony keeping clocks in sync — clock skew breaks TLS, Kerberos, and distributed systems. Verify with `timedatectl`.\n- **Cron vs systemd timers.** Timers give you logging, dependencies, and failure handling that cron lacks; use timers for anything important, cron for trivial personal tasks.\n- **Backups.** `rsync`\u002F`restic`\u002F`borg` for files, database-native dumps for DBs, tested restores. Automate, monitor, and periodically verify — untested backups are rumors.\n- **Security basics.** Minimal installed packages, automatic security updates, fail2ban or equivalent for SSH, no unnecessary listening services (`ss -tlnp` audit), file integrity awareness.\n\n## Practical workflow\n\n1. **Diagnose systematically.** Load (`uptime`, `htop`), disk (`df -h`, `df -i`), memory (`free -h`, `dmesg | grep -i oom`), network (`ss`, `ping`, `curl -v`), logs (`journalctl`). Work from symptoms to layer, not guesses.\n   ```bash\n   # the 60-second triage\n   uptime; df -h; df -i; free -h\n   ss -tlnp | head -20\n   journalctl -p err --since \"15 min ago\" | tail -20\n   ```\n2. **Manage permissions correctly.** Least-privilege ownership; groups for shared access; `find` for permission audits:\n   ```bash\n   chown -R app:app \u002Fsrv\u002Fapp\n   chmod 750 \u002Fsrv\u002Fapp\n   find \u002Fsrv\u002Fapp -type f -perm \u002Fo+w  # world-writable files: investigate\n   ```\n3. **Control services with systemd.** Write unit files with `Restart=on-failure`, sandboxing (`ProtectSystem`, `PrivateTmp`), resource limits; timers for scheduled work.\n   ```ini\n   [Unit]\n   Description=Shop API\n   After=network.target\n   [Service]\n   User=app\n   ExecStart=\u002Fopt\u002Fshop\u002Fapi\n   Restart=on-failure\n   ProtectSystem=strict\n   [Install]\n   WantedBy=multi-user.target\n   ```\n4. **Harden SSH.** Key-only auth, no root login, non-standard port optional (obscurity, not security), fail2ban, ProxyJump instead of agent forwarding.\n5. **Debug networking layer by layer.** `ip addr` → `ip route` → `getent hosts`\u002F`dig` → `ss -tlnp` → firewall rules → `curl -v`. Each layer has its own tools; skipping layers wastes hours.\n6. **Manage logs.** journald with persistent storage and rate limits; logrotate for file logs; ship to central logging; alert on error patterns, not just disk space.\n7. **Keep systems updated.** Automatic security updates; planned maintenance windows for major upgrades; know what's installed and why.\n8. **Back up and verify.** Automated backups with monitoring; periodic restore tests; document the recovery procedure — the runbook written during calm saves the outage.\n\n## Common pitfalls\n\n- **`chmod 777`** — never the fix; find the right user\u002Fgroup and permission.\n- **KILL as first resort** — data corruption and unclean shutdown; TERM first, wait, then KILL.\n- **Ignoring inodes** — \"disk full\" with free space; `df -i` reveals inode exhaustion (millions of small files).\n- **Full disks from logs** — no logrotate\u002Fjournald limits; monitor disk and bound log growth.\n- **Password SSH auth** — brute-force target; keys only, fail2ban as backup.\n- **Running everything as root** — compromise blast radius; service users per app.\n- **No NTP** — clock skew breaking TLS and auth; chrony everywhere.\n- **Cron for critical tasks** — no logging or failure handling; systemd timers instead.\n- **Untested backups** — discovered broken during an outage; verify restores regularly.\n- **Firewall misconfigurations** — locking yourself out remotely; test rules with a safety revert (e.g., `at` job restoring access).\n- **OOM kills misdiagnosed** — app \"crashing\" that's actually memory limits; check `dmesg`.\n- **Stale packages** — unpatched CVEs; automatic security updates at minimum.\n- **Deleting open files** — `rm` on a file a process holds doesn't free space; truncate or restart the holder.\n",{"name":5,"category":24,"description":7},"development","main","af388a77c2fe5e0b4fd879cca4300a0ffa9a6579","skills\u002Fams-linux-pro",1,"https:\u002F\u002Fgithub.com\u002FTanNhatCMS\u002Fjarvis","https:\u002F\u002Fgithub.com\u002FTanNhatCMS","https:\u002F\u002Fmrkiet.name.vn","2026-11-07 14:23:08",{"source":8,"skillName":5,"commands":34,"prompt":44,"zipAvailable":45},[35,38,41],{"tool":36,"command":37},"npx","npx skills add TanNhatCMS\u002Fjarvis --skill linux-pro",{"tool":39,"command":40},"bunx","bunx skills add TanNhatCMS\u002Fjarvis --skill linux-pro",{"tool":42,"command":43},"pnpm","pnpm dlx skills add TanNhatCMS\u002Fjarvis --skill linux-pro","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FTanNhatCMS\u002Fjarvis\u002Fblob\u002Fmain\u002Fskills\u002Fams-linux-pro\u002FSKILL.md",true,[],[48,55,63,70,77,84],{"skillNo":49,"name":50,"nameZh":6,"description":51,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":52,"categories":53,"keywords":54,"publishedAt":19},"01M7EWYJR0J8DARY7E59Z6Y9MV","web-scrape","Turn web pages into LLM-ready markdown via the Firecrawl API (renders JS, anti-bot handling). Use when browser_open\u002Ffetch fails on JS-heavy pages, or when you need clean markdown\u002Fstructured extraction from a site. Requires FIRECRAWL_API_KEY.","https:\u002F\u002Fgithub.com\u002FTanNhatCMS\u002Fjarvis\u002Fblob\u002Fmain\u002Fskills\u002Fweb-scrape\u002FSKILL.md",[],[],{"skillNo":56,"name":57,"nameZh":6,"description":58,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":59,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":19},"01M7EWYBN5P6F2AJG3FR24T9BP","design-taste-frontend","tasteskill v2, the anti-slop frontend skill. Art direction for websites, distilled from a study of 247 curated gallery sites (One Page Love, Awwwards Sites of the Day). Deals researched directions (idea, composition, type, palette, photographs, section blueprints) from a library, enforces a strict no-slop house style with a real-browser inspector, and runs a look-and-fix loop on screenshots. Use this whenever you build, design, redesign, restyle, polish or review a landing page, marketing site, portfolio, product page, one-pager, hero or any public-facing web page, in any stack (HTML\u002FCSS, React, Next.js, Vue, Svelte, Astro, Tailwind) — also when the user says a page looks generic, templated, \"AI-made\", sloppy, or asks to make it look designed, premium, award-level or less like every other site. Not for dashboards or app screens.","https:\u002F\u002Fgithub.com\u002FTanNhatCMS\u002Fjarvis\u002Fblob\u002Fmain\u002Fskills\u002Ftaste-design\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FTanNhatCMS\u002Fjarvis\u002Fblob\u002Fmain\u002Fskills\u002Ftaste-design\u002FSKILL.md",[],[],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":69,"publishedAt":19},"01M7EWY8FQFNQ2GB7NZZWGSSDX","test-driven-development","Use when implementing any feature or bugfix, before writing implementation code","https:\u002F\u002Fgithub.com\u002FTanNhatCMS\u002Fjarvis\u002Fblob\u002Fmain\u002Fskills\u002Fsuperpowers-tdd\u002FSKILL.md",[],[],{"skillNo":71,"name":72,"nameZh":6,"description":73,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":19},"01M7EWY5SHBFRH1HDHVWM9K7TV","systematic-debugging","Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes","https:\u002F\u002Fgithub.com\u002FTanNhatCMS\u002Fjarvis\u002Fblob\u002Fmain\u002Fskills\u002Fsuperpowers-debugging\u002FSKILL.md",[],[],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":19},"01M7EWY3NM0Z0JAKS7HDZ24K66","requesting-code-review","Use when completing tasks, implementing major features, or before merging to verify work meets requirements","https:\u002F\u002Fgithub.com\u002FTanNhatCMS\u002Fjarvis\u002Fblob\u002Fmain\u002Fskills\u002Fsuperpowers-code-review\u002FSKILL.md",[],[],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":19},"01M7EWY0WRMWX4M9ZFY0WKC593","brainstorming","You MUST use this before any creative work - creating features, building components, adding functionality, modifying behavior, or planning anything new, in software or out of it (a talk, a business, a renovation).","https:\u002F\u002Fgithub.com\u002FTanNhatCMS\u002Fjarvis\u002Fblob\u002Fmain\u002Fskills\u002Fsuperpowers-brainstorming\u002FSKILL.md",[],[]]